Skip to main content
Version: 3.0.0-preview

AD-GPOREP-16 - No GPOs should have version mismatches

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Test-MtAdGpoVersionMismatchDetails​

Returns details of GPOs with a version mismatch.

Why This Test Matters​

  • Detective control: identifies GPOs where the version reported has a mismatch, potentially indicating stale or misapplied policy definitions.

Control Type​

Detective

Security Recommendation​

  • Validate GPO versions against a known baseline and correct mismatches to ensure consistent policy behavior.

How the Test Works​

  • Fetches GPO state, filters GPOReports for HasVersionMismatch being true, and presents a table of mismatched GPOs.
  • Test-MtAdGpoVersionMismatchCount - counts GPOs with version mismatches.

Test Metadata​

FieldValue
Test IDAD-GPOREP-16
SeverityMedium
SuiteActive Directory
ProductActive Directory
FeatureGroup Policy
AreaInfrastructure hardening
Resource typeGroupPolicy
User impactLow
Implementation costMedium
MITRE ATT&CKNone
PowerShell testTest-MtAdGpoVersionMismatchDetails
ServicesActiveDirectory

Source​